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ABSTRACT 

A method for detecting intrusion in a database, managed by an access control 
system, includes defining at least one intrusion detection profile and associating each 
user with one of said profiles. Each profile includes at least one item access rate. 
Further, the method determines whether a result of a query exceeds any one of the 
item access rates defined in the profile associated with the user. In such a case, the 
access control system is notified to alter the user authorization, thereby making the 
received request an unauthorized request, before the result is transmitted to the user. 
Such a method allows for a real time prevention of intrusion by letting the intrusion 
detection process interact directly with the access control system, and change the user 
authority dynamically as a result of the detected intrusion. 
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